CVE-2018-12066

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-06-08 · updated 2026-06-17
Weakness: CWE-400

Description

BIRD Internet Routing Daemon before 1.6.4 allows local users to cause a denial of service (stack consumption and daemon crash) via BGP mask expressions in birdc.

Affected products

Bird Project Bird: before 1.6.4 — fixed in 1.6.4

How to fix

Upgrade to a fixed version: Bird Project Bird 1.6.4. Check the vendor advisory for mitigations.

References

http://bird.network.cz
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900967
https://gitlab.labs.nic.cz/labs/bird/blob/v1.6.4/NEWS#L11
https://gitlab.labs.nic.cz/labs/bird/commit/e8bc64e308586b6502090da2775af84cd760ed0d
http://bird.network.cz
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=900967
https://gitlab.labs.nic.cz/labs/bird/blob/v1.6.4/NEWS#L11
https://gitlab.labs.nic.cz/labs/bird/commit/e8bc64e308586b6502090da2775af84cd760ed0d

Get alerted when CVE-2018-12066 or the next vulnerability affects your stack